Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.6.6

AzureRM Provider Version

7.3.0

Affected Resource(s)/Data Source(s)

postgres flexible server deployment

Terraform Configuration Files

in the process of postgres db creation, terraform fails right after apply the firewall filters.

such as making more configurations after postgres flexible server is deployed.
For example the following configuration wouldn't complete and fails after the firewall filters are applied.


module "postgresql_users" {
  source  = "claranet/users/postgresql"
  version = "6.0.0"

  for_each = module.postgresql_flexible.postgresql_flexible_databases_names
  administrator_login = module.postgresql_flexible.postgresql_flexible_administrator_login
  database = each.key
}

module "postgresql_configuration" {
  source  = "claranet/database-configuration/postgresql"
  version = "6.0.0"

  for_each = module.postgresql_flexible.postgresql_flexible_databases_names

  administrator_login = module.postgresql_flexible.postgresql_flexible_administrator_login
  database_admin_user = module.postgresql_users[each.key].user
  database            = each.key
  schema_name         = each.key
}

Debug Output/Panic Output

module.accelerator.module.postgresql_flexible.azurerm_postgresql_flexible_server_firewall_rule.firewall_rules["0"]: Still creating... [30s elapsed]
module.accelerator.module.postgresql_flexible.azurerm_postgresql_flexible_server_firewall_rule.firewall_rules["0"]: Still creating... [40s elapsed]
module.accelerator.module.postgresql_flexible.azurerm_postgresql_flexible_server_firewall_rule.firewall_rules["0"]: Still creating... [50s elapsed]
module.accelerator.module.postgresql_flexible.azurerm_postgresql_flexible_server_firewall_rule.firewall_rules["0"]: Still creating... [1m0s elapsed]
module.accelerator.module.postgresql_flexible.azurerm_postgresql_flexible_server_firewall_rule.firewall_rules["0"]: Creation complete after 1m2s [id=/subscriptions/xxxxxxxxxxxxxxxx/resourceGroups/rg-fgeasf9/providers/Microsoft.DBforPostgreSQL/flexibleServers/psqlf-default-stack-bla-dev/firewallRules/0]
╷
│ Error: Error connecting to PostgreSQL server  (scheme: postgres): XXXXdXXXXial tcp 127.0.0.1:5432: connect: connection refused
│ 
│   with module.accelerator.module.postgresql_configuration["main_db"].postgresql_grant.revoke_public,
│   on .terraform/modules/accelerator.postgresql_configuration/r-psql-db-config.tf line 1, in resource "postgresql_grant" "revoke_public":
│    1: resource "postgresql_grant" "revoke_public" {
│ 
╵

Expected Behaviour

should apply the firewall filter as the last process so that other operations are not blocked.

Actual Behaviour

fails in the middle of deployment

Steps to Reproduce

No response

Important Factoids

No response

References

No response

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

currently there is no support this "public_network_access_enabled = false"
would be nice have in place.

New or Affected Resource(s)/Data Source(s)

none

Potential Terraform Configuration

module "postgresql_flexible" {
  source  = "claranet/db-postgresql-flexible/azurerm"
  version = "7.3.0"

  name_prefix         = "postgresql-flexible-server"
  ...
  public_network_access_enabled = false
  ...
}

References

https://registry.terraform.io/modules/Azure/postgresql/azurerm/latest

Community Note

When using the claranet/db-postgresql-flexible/azurerm module to deploy an Azure PostgreSQL Flexible Server with a virtual network configuration, a conflict arises due to the lack of an option to disable public network access.
The module requires the allowed_cidrs attribute to be specified, even when public access is not desired. Setting allowed_cidrs to an empty map {} does not resolve the issue, as the module still attempts to configure both public network access and virtual network integration, resulting in the following error:
Copy codeError: creating Flexible Server (Subscription: "28197c15-da6c-4e66-b241-cd23f9550102"
Resource Group Name: "rg-test-tsp1-acc"
Flexible Server Name: "psqlf-test-tsp1-gwc-acc"): performing Create: unexpected status 400 (400 Bad Request) with error: ConflictingPublicNetworkAccessAndVirtualNetworkConfiguration: Conflicting configuration is detected between Public Network Access and Virtual Network arguments. Public Network Access is not supported along with Virtual Network feature.
The documentation does not provide any information on how to disable public network access or resolve this conflict.

Please advise on how to resolve this issue or provide guidance on disabling public network access when using the claranet/db-postgresql-flexible/azurerm module with virtual network integration.

Terraform Version

1.7.2

AzureRM Provider Version

3.80

Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server.postgresql_flexible_server

Terraform Configuration Files

#https://github.com/claranet/terraform-azurerm-db-postgresql-flexible/tree/master/examples/delegated_subnet

module "azure_region" {
  source  = "claranet/regions/azurerm"
  version = "7.1.1"

  azure_region = var.location
}

module "rg" {
  source  = "claranet/rg/azurerm"
  version = "6.1.1"

  location    = module.azure_region.location
  client_name = var.application
  environment = var.environment
  stack       = var.stack
}


resource "random_password" "admin_password" {
  special = "false"
  length  = 32
}



module "vnet" {
  source  = "claranet/vnet/azurerm"
  version = "7.0.0"

  environment    = var.environment
  location       = module.azure_region.location
  location_short = module.azure_region.location_short
  client_name    = var.application
  stack          = var.stack

  resource_group_name = module.rg.resource_group_name

  vnet_cidr = [var.vnet_cidr]
}

module "subnet" {
  source  = "claranet/subnet/azurerm"
  version = "7.0.0"

  environment    = var.environment
  location_short = module.azure_region.location_short
  client_name    = var.application
  stack          = var.stack

  resource_group_name  = module.rg.resource_group_name
  virtual_network_name = module.vnet.virtual_network_name

  subnet_cidr_list = [var.subnet_cidr]

  service_endpoints = ["Microsoft.Storage"] # Beispielwert, passe ihn an deine Anforderungen an

  subnet_delegation = {
    postgresql-flexible = [
      {
        name    = "Microsoft.DBforPostgreSQL/flexibleServers"
        actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
      }
    ]
  }
}

resource "azurerm_private_dns_zone" "postgres" {
  name                = format("%s-%s.postgres.database.azure.com", var.environment, var.stack)
  resource_group_name = module.rg.resource_group_name
}

resource "azurerm_private_dns_zone_virtual_network_link" "postgres" {
  name                = format("%s_dns_zone_postgres_%s", var.stack, var.environment)
  resource_group_name = module.rg.resource_group_name

  private_dns_zone_name = azurerm_private_dns_zone.postgres.name
  virtual_network_id    = module.vnet.virtual_network_id
}
module "postgresql_flexible" {
  source  = "claranet/db-postgresql-flexible/azurerm"
  version = "7.3.1"

  client_name    = var.application
  location       = module.azure_region.location
  location_short = module.azure_region.location_short
  environment    = var.environment
  stack          = var.stack

  resource_group_name = module.rg.resource_group_name

  depends_on = [
    azurerm_private_dns_zone_virtual_network_link.postgres, module.vnet
  ]

  tier               = "GeneralPurpose"
  size               = "D2s_v3"
  storage_mb         = 32768
  postgresql_version = 13

  allowed_cidrs = {}

  backup_retention_days        = 14
  geo_redundant_backup_enabled = true

  administrator_login    = "azureadmin"
  administrator_password = random_password.admin_password.result

  databases = {
    mydatabase = {
      collation = "en_US.utf8"
      charset   = "UTF8"
    }
  }

  maintenance_window = {
    day_of_week  = 3
    start_hour   = 3
    start_minute = 0
  }

  logs_destinations_ids = [
  ]

  private_dns_zone_id = azurerm_private_dns_zone.postgres.id
  delegated_subnet_id = module.subnet.subnet_id

  extra_tags = {
    foo = "bar"
  }
}

Debug Output/Panic Output

╷
│ Error: creating Flexible Server (Subscription: "28197c14-da6c-4e66-b241-cd23f9550102"
│ Resource Group Name: "rg-test-tsp1-acc"
│ Flexible Server Name: "psqlf-test-tsp1-gwc-acc"): performing Create: unexpected status 400 (400 Bad Request) with error: ConflictingPublicNetworkAccessAndVirtualNetworkConfiguration: Conflicting configuration is detected between Public Network Access and Virtual Network arguments. Public Network Access is not supported along with Virtual Network feature.
│ 
│   with module.postgresql_flexible.azurerm_postgresql_flexible_server.postgresql_flexible_server,
│   on .terraform/modules/postgresql_flexible/r-postgresql-flexible.tf line 1, in resource "azurerm_postgresql_flexible_server" "postgresql_flexible_server":
│    1: resource "azurerm_postgresql_flexible_server" "postgresql_flexible_server" {
│ 
╵

Expected Behaviour

The module should allow for the creation of an Azure PostgreSQL Flexible Server with virtual network integration and public network access disabled.

Actual Behaviour

The module encounters a conflict between the public network access and virtual network configuration, preventing the successful creation of the Azure PostgreSQL Flexible Server.

Steps to Reproduce

I mainly just used yor example deployment. https://github.com/claranet/terraform-azurerm-db-postgresql-flexible/tree/master/examples/delegated_subnet

1. Configure the claranet/db-postgresql-flexible/azurerm module with a delegated subnet ID (delegated_subnet_id) and an empty allowed_cidrs map.

terraform plan is no problem.
2. terraform apply --> the error will come up.

Important Factoids

No response

References

No response

We tried yesterday your terraform module for a standard postgres database. The approach seems to be promising
for us, however, we would be more interested in the implementation of the flexible postgres database.

Do you have any timeline for this project?

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.4.4

AzureRM Provider Version

3.73.0

Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server_database

Terraform Configuration Files

module "db-postgresql-flexible" {
  source  = "claranet/db-postgresql-flexible/azurerm"
  version = "7.0.0"

  administrator_login    = "admin"                                                                                             
  administrator_password = "password"
  allowed_cidrs = {
    "all"   = "0.0.0.0/32"
  }

  custom_server_name    = "postgresql-flexible-server"
  client_name           = ""
  environment           = ""
  location              = "West Europe"
  location_short        = ""
  logs_destinations_ids = []
  resource_group_name   = "resource_group"
  stack                 = ""
  postgresql_version    = 13

  storage_mb   = 131072
  standby_zone = null

  postgresql_configurations = {}
  databases = {
    main = {
      collation = "en_US.UTF8"
      charset   = "UTF8"
    }
  }
}

Debug Output/Panic Output

│ Error: collation contains unknown collation en_US.UTF8
│ 
│   with module.db-postgresql-flexible[0].azurerm_postgresql_flexible_server_database.postgresql_flexible_db["main"],
│   on .terraform/modules/db-postgresql-flexible/r-postgresql-flexible.tf line 59, in resource "azurerm_postgresql_flexible_server_database" "postgresql_flexible_db":
│   59:   collation = each.value.collation

Expected Behaviour

The resource should be successfully be created

Actual Behaviour

This should work until azurerm 3.69.0 version. They introduced some validation on the collation field that the default "en_US.UTF8" doesn't comply any more. The value "en_US.utf8" passes the validation and works but forces the complete replacement of the resource which isn't favorable for many production scenarios. It would be nice to have the collation on ignore_changes lifecycle maybe.

More information can be found in this issue in the AzureRM provider repository:
hashicorp/terraform-provider-azurerm#22936

Steps to Reproduce

1. terraform apply

Important Factoids

No response

References

No response

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Azure Portal offers the following option for the firewall rules:

According to https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-firewall-rules#programmatically-manage-firewall-rules it can be achieved programmatically too:

From the Azure CLI, a firewall rule setting with a starting and ending address equal to 0.0.0.0 does the equivalent of the Allow public access from any Azure service within Azure to this server option in the portal.

because it is supported by the Resource Manager HTTP API:

Use value '0.0.0.0' for all Azure-internal IP addresses

In fact, it is also feasible to achieve with this module, for example

module "postgresql_flexible" {
  source  = "claranet/db-postgresql-flexible/azurerm"
  version = "x.x.x"

  allowed_cidrs = {
    "AzureServices" = "0.0.0.0/32"  # Allow public access from any Azure service within Azure to this server
  }
  ...

but that is thanks to the peculiar behaviour of the cidrhost function:

called in

Proposal

Wouldn't the module's interface be clearer if there was a dedicated boolean variable that controls the feature and the module hides the obscure 0.0.0.0-0.0.0.0 trick for the Azure services?

New or Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server_firewall_rule

Potential Terraform Configuration

variable "allow_public_access_from_azure_services" {
  description = "Allow public access from any Azure service within Azure to this server"
  default = false
  type = bool
}

References

• hashicorp/terraform-provider-azurerm#13873